It is challenging to ensure that customers are satisfied with a given service on an on-going basis due to ever changing conditions. For example, a network service provider may provide a cellular service, but changing conditions may occur, e.g., a network component may fail, a new bandwidth requirement may impact the overall quality of service, and the like. One approach may implement the given service via a software defined network (SDN) architecture, which is capable of reacting to changing conditions. However, without understanding the underlying triggers of the changing conditions, the software defined network may over-react to the changing conditions that may have been caused by nefarious actions taken by individuals who may want to attack the software defined network.